d4409b27a3
Adds opt-in HTTP Basic auth to the hive-gateway backed by the host PAM stack + group membership check. New binary `hive-gateway-auth` (hive-c0re workspace): - Axum HTTP service on 127.0.0.1:7002 (host loopback) - Decodes Basic credentials, authenticates via pam_unix.so - Checks membership in `hyperhive-operator` group (or custom) - Returns 200 / 401 / 403; nginx `auth_request` consumes these New options under `services.hyperhive.gateway.auth`: - `enable` — off by default - `port` — auth service port (default 7002) - `realm` — WWW-Authenticate realm string (default "hyperhive") - `group` — required host group (default "hyperhive-operator") - `pamService` — PAM service name (default "hive-gateway") Host-side NixOS wiring: - `users.groups.hyperhive-operator` declared when default group used - `/etc/pam.d/hive-gateway` emitted via `security.pam.services` - `systemd.services.hive-gateway-auth` runs the auth binary as root (needs /etc/shadow access for pam_unix.so) Gateway container nginx wiring: - `location = /__hive_gateway_auth` — internal proxy to auth service - `auth_request /__hive_gateway_auth` on the `"/"` proxy location - `@hive_auth_required` named location adds WWW-Authenticate: Basic header on 401 so browsers display a login prompt Workspace deps: pam = "0.8"; flake.nix: linux-pam added to nativeBuildInputs so pkg-config can find libpam at build time.
51 lines
1.4 KiB
TOML
51 lines
1.4 KiB
TOML
[workspace]
|
|
resolver = "3"
|
|
members = ["hive-ag3nt", "hive-c0re", "hive-forge", "hive-matrix-mcp", "hive-priv", "hive-sh4re"]
|
|
|
|
[workspace.package]
|
|
edition = "2024"
|
|
version = "0.1.0"
|
|
|
|
[workspace.lints.clippy]
|
|
pedantic = { level = "warn", priority = -1 }
|
|
# Tolerated stylistic pedantic lints (noisy, not actionable).
|
|
missing_errors_doc = "allow"
|
|
missing_panics_doc = "allow"
|
|
module_name_repetitions = "allow"
|
|
must_use_candidate = "allow"
|
|
|
|
[workspace.dependencies]
|
|
anyhow = "1"
|
|
pam = "0.8"
|
|
axum = { version = "0.8", features = ["ws"] }
|
|
base64 = "0.22"
|
|
clap = { version = "4", features = ["derive"] }
|
|
hive-sh4re = { path = "hive-sh4re" }
|
|
tower-http = { version = "0.6", features = ["fs"] }
|
|
rmcp = { version = "1.7", default-features = false, features = [
|
|
"server",
|
|
"macros",
|
|
"transport-io",
|
|
] }
|
|
rusqlite = { version = "0.37", features = ["bundled"] }
|
|
schemars = "1.0"
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
similar = "2"
|
|
tokio = { version = "1", features = [
|
|
"fs",
|
|
"io-util",
|
|
"macros",
|
|
"net",
|
|
"process",
|
|
"rt-multi-thread",
|
|
"signal",
|
|
"sync",
|
|
"time",
|
|
] }
|
|
tokio-stream = { version = "0.1", features = ["sync"] }
|
|
tracing = "0.1"
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
|
|
reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
|
|
matrix-sdk = { version = "0.14", default-features = false, features = ["rustls-tls", "sqlite", "markdown"] }
|
|
futures-util = "0.3"
|